Simplify MCP

// Traditional Agent approach – each API has a different interface
const flightData = await fetch('/api/flights', {
  method: 'POST',
  body: JSON.stringify({ from: 'SIN', to: 'EVE' }),
})

const weatherData = await axios.get('/weather/api', {
  params: { city: 'Harstad', format: 'json' },
})

const hotelData = await request.post('/booking/hotels', {
  location: 'Harstad',
  checkin: '2024-08-08',
})

// MCP approach – unified protocol interface
const flightResult = await mcpClient.callTool('flight-server', 'search_flights', {
  from: 'SIN',
  to: 'EVE',
})

const weatherResult = await mcpClient.callTool('weather-server', 'get_weather', {
  location: 'Harstad',
})

const hotelResult = await mcpClient.callTool('hotel-server', 'search_hotels', {
  location: 'Harstad',
  date: '2024-08-08',
})

# Traditional approach: adding a new service
- Study API docs (2-3 days)
- Write integration code (3-5 days)
- Test and debug (2-3 days)
- Total: 7-11 days

# MCP approach: adding a new service
- Implement MCP Server (1-2 days)
- Register with MCP ecosystem (minutes)
- Total: 1-2 days

// MCP Server config example
interface MCPServerConfig {
  name: string
  version: string

  authorization: {
    type: 'bearer' | 'apikey' | 'oauth2' | 'custom'
    apiKey?: {
      header: string
      required: boolean
    }
    oauth2?: {
      authUrl: string
      tokenUrl: string
      scopes: string[]
    }
    customAuth?: (request: MCPRequest) => Promise<boolean>
  }

  permissions: {
    tools: {
      [toolName: string]: {
        allowedHosts: string[]
        rateLimits: {
          requests: number
          timeWindow: number
        }
        requireAuth: boolean
      }
    }
    resources: {
      read: boolean
      write: boolean
      delete: boolean
    }
  }
}

// Enterprise Auth Provider implementation
class EnterpriseAuthProvider implements AuthProvider {
  constructor(private ldapConfig: LDAPConfig) {}

  async validateCredentials(hostId: string, credentials: Credentials): Promise<AuthResult> {
    // 1. Connect to LDAP/AD
    const ldapClient = new LDAPClient(this.ldapConfig)

    // 2. Authenticate host app
    const appIdentity = await ldapClient.authenticate(credentials.clientId, credentials.secret)

    // 3. Get app permissions
    const permissions = await this.getAppPermissions(hostId)

    return {
      valid: true,
      hostId,
      permissions,
      token: this.generateJWT(appIdentity, permissions),
    }
  }
}

// Microsoft EntraID Auth Provider implementation
class EntraIDAuthProvider implements AuthProvider {
  constructor(private entraConfig: EntraIDConfig) {}

  async validateCredentials(hostId: string, credentials: Credentials): Promise<AuthResult> {
    try {
      // 1. Use Client Credentials Flow to authenticate app
      const tokenResponse = await this.getAccessToken(credentials)
      // 2. Validate token and get app info
      const appInfo = await this.validateToken(tokenResponse.access_token)
      // 3. Get app role assignments and permissions
      const permissions = await this.getApplicationPermissions(appInfo.appId, hostId)
      return {
        valid: true,
        hostId,
        permissions,
        token: tokenResponse.access_token,
        expiresAt: new Date(Date.now() + tokenResponse.expires_in * 1000),
      }
    } catch (error) {
      return { valid: false, error: `EntraID authentication failed: ${error.message}` }
    }
  }
  // ...implementation details omitted for brevity...
}

# MCP Server config - EntraID integration
mcp_server:
  name: 'travel-booking-server'
  version: '1.0.0'
  auth_provider:
    type: 'entraid'
    entraid:
      tenant_id: '${AZURE_TENANT_ID}'
      client_id: '${MCP_SERVER_CLIENT_ID}'
      client_secret: '${MCP_SERVER_CLIENT_SECRET}'
      scopes:
        - 'https://graph.microsoft.com/Application.Read.All'
        - 'api://mcp-travel-server/MCP.Access'
      role_permissions:
        'MCP.FlightSearch.Reader':
          permissions: ['search_flights', 'get_prices']
          rate_limits:
            requests_per_minute: 100
        'MCP.TravelAgent.Full':
          permissions: ['search_flights', 'search_hotels', 'make_reservation']
          rate_limits:
            requests_per_minute: 200
        'MCP.Admin':
          permissions: ['*']
          rate_limits:
            requests_per_minute: 500
  allowed_hosts:
    'claude.ai':
      entraid_app_id: '${CLAUDE_APP_ID}'
      required_roles: ['MCP.TravelAgent.Full']
    'openai.com':
      entraid_app_id: '${OPENAI_APP_ID}'
      required_roles: ['MCP.FlightSearch.Reader']

{
  "displayName": "MCP Travel Booking Server",
  "signInAudience": "AzureADMyOrg",
  "api": {
    "requestedAccessTokenVersion": 2,
    "oauth2PermissionScopes": [{ "id": "...", "value": "MCP.Access" }]
  },
  "appRoles": [{ "value": "MCP.FlightSearch.Reader" }, { "value": "MCP.TravelAgent.Full" }]
}

// Auth0 integration example
class Auth0Provider implements AuthProvider {
  constructor(private auth0Config: Auth0Config) {}

  async validateCredentials(hostId: string, credentials: Credentials): Promise<AuthResult> {
    // 1. Call Auth0 API to validate
    const auth0Response = await fetch(`${this.auth0Config.domain}/oauth/token`, {
      /* ... */
    })
    const tokenData = await auth0Response.json()
    // 2. Parse permission scopes
    const permissions = this.parseScopes(tokenData.scope)
    return {
      valid: true,
      hostId,
      permissions,
      token: tokenData.access_token,
    }
  }
}

// MCP Server built-in authentication
class MCPServerAuthProvider implements AuthProvider {
  constructor(private apiKeyStore: APIKeyStore) {}

  async validateCredentials(hostId: string, credentials: Credentials): Promise<AuthResult> {
    // 1. Validate API Key
    const apiKeyInfo = await this.apiKeyStore.validate(credentials.apiKey)
    if (!apiKeyInfo.valid) {
      return { valid: false, error: 'Invalid API key' }
    }
    // 2. Check host whitelist
    if (!apiKeyInfo.allowedHosts.includes(hostId)) {
      return { valid: false, error: 'Host not authorized' }
    }
    // 3. Return permission info
    return {
      valid: true,
      hostId,
      permissions: apiKeyInfo.permissions,
      token: this.generateSessionToken(hostId, apiKeyInfo),
    }
  }
}

# MCP Server config
mcp_server:
  name: 'travel-booking-server'
  version: '1.0.0'
  auth_provider:
    type: 'enterprise' # options: enterprise, auth0, okta, builtin, aws_cognito
    enterprise:
    auth0:
    builtin:
  permissions:
    default_permissions: ['search_flights']
    host_specific:

// Secure MCP Client implementation
class SecureMCPClient {
  private authTokens: Map<string, AuthToken> = new Map()

  async connectToServer(serverConfig: MCPServerConfig) {
    // 1. Validate server certificate
    const serverInfo = await this.validateServerCertificate(serverConfig)
    // 2. Get auth token
    const authToken = await this.authenticate(serverConfig.authorization)
    // 3. Establish secure connection
    const connection = await this.establishSecureConnection(serverConfig, authToken)
    return connection
  }

  private async authenticate(authConfig: AuthConfig): Promise<AuthToken> {
    switch (authConfig.type) {
      case 'oauth2':
        return await this.handleOAuth2Flow(authConfig.oauth2)
      case 'apikey':
        return await this.handleAPIKeyAuth(authConfig.apiKey)
      case 'bearer':
        return await this.handleBearerTokenAuth(authConfig.bearer)
      default:
        throw new Error('Unsupported auth type')
    }
  }
}

// MCP Server security middleware
class MCPSecurityMiddleware {
  async validateRequest(request: MCPRequest, context: SecurityContext): Promise<boolean> {
    // 1. Validate host identity
    const hostValid = await this.validateHost(context.hostId, context.credentials)
    if (!hostValid) return false
    // 2. Check tool permissions
    const toolPermissions = this.getToolPermissions(request.method, context.hostId)
    if (!toolPermissions.allowed) return false
    // 3. Rate limit check
    const rateLimitOk = await this.checkRateLimit(context.hostId, request.method)
    if (!rateLimitOk) return false
    // 4. Parameter validation
    const paramsValid = await this.validateParameters(request.params)
    if (!paramsValid) return false
    return true
  }

  private async checkRateLimit(hostId: string, method: string): Promise<boolean> {
    const key = `${hostId}:${method}`
    const current = (await this.redis.get(key)) || 0
    const limit = this.rateLimits[method] || 100
    if (current >= limit) {
      await this.logSecurityEvent('rate_limit_exceeded', { hostId, method })
      return false
    }
    await this.redis.incr(key)
    await this.redis.expire(key, 60) // 1 minute window
    return true
  }
}

// Security audit system
class MCPAuditLogger {
  async logSecurityEvent(event: SecurityEvent) {
    const auditRecord = {
      timestamp: new Date().toISOString(),
      hostId: event.hostId,
      serverId: event.serverId,
      action: event.action,
      success: event.success,
      ipAddress: event.ipAddress,
      userAgent: event.userAgent,
      requestData: this.sanitizeData(event.requestData),
      responseData: this.sanitizeData(event.responseData),
      authMethod: event.authMethod,
      permissions: event.permissions,
      rateLimitStatus: event.rateLimitStatus,
    }
    await this.writeToAuditLog(auditRecord)
    if (this.detectSuspiciousActivity(auditRecord)) {
      await this.triggerSecurityAlert(auditRecord)
    }
  }
  private sanitizeData(data: any): any {
    // Remove sensitive info: passwords, API keys, PII, etc.
    return this.deepClone(data, this.sensitiveFieldsFilter)
  }
}